Enhanced/Dual Powered

Willem EPROM Programmer

User Guide  

 

Willem Package Item Image

Supported IC List

Installation & Configuration

Jumper Configuraton

Self Test Function

Software Interface

FLASH Chip Programming

EPROM Chip Programming

EEPROM Chip Programming

ATMEL Chip Programming

PIC Chip Programming

AVR Chip Programming

ATMEL AT89 Adapter

ATMEL PLCC44 Adapter

TSOP48 Adapter

Willem Package Item Image  

Main Board / Cables

Main Board PCB3.5

palo alto failed to fetch device certificate tpm public key match failed

 

Main Board PCB4E

palo alto failed to fetch device certificate tpm public key match failed

 

Main Board PCB5.0

palo alto failed to fetch device certificate tpm public key match failed

 

Main Board PCB5.5C

palo alto failed to fetch device certificate tpm public key match failed

 

Parallel Data Cable (Printer extension cable, with male-female 25 pin connector, and pin to pin through)

A-A type USB cable(for power)

palo alto failed to fetch device certificate tpm public key match failed

palo alto failed to fetch device certificate tpm public key match failed

                                

          

Optional Items:

ATMEL 89 Adapter

ATMEL PLCC 44 Adapter

TSOP 48 Adapter

palo alto failed to fetch device certificate tpm public key match failed

palo alto failed to fetch device certificate tpm public key match failed

palo alto failed to fetch device certificate tpm public key match failed

FWH/HUB PLCC32Adapter

PLCC32 Adapter

SOIC Adapter(Simplified)

On-Board

On-Board

palo alto failed to fetch device certificate tpm public key match failed

AC or DC Power Adapter (9V or 12V, 200mA)

SOIC Adapter(Professional)

 

palo alto failed to fetch device certificate tpm public key match failed

palo alto failed to fetch device certificate tpm public key match failed

 

 

Supported Device List

Palo Alto Failed To Fetch Device Certificate Tpm Public Key Match Failed New! ❲2024-2026❳

Connect to the firewall's Command Line Interface (CLI) via SSH. Enter configuration mode: configure Use code with caution. Execute a forced commit: commit force Use code with caution. Exit configuration mode and test the certificate fetch: exit request certificate fetch Use code with caution.

By systematically following the steps outlined—verifying TPM health, deleting stale certificates, forcing fresh auto-enrollment, and resetting GP cache—administrators can restore seamless VPN connectivity without rebuilding machines or disabling TPM security. As enterprises move toward zero-trust architectures requiring hardware-backed identity, mastering TPM certificate troubleshooting becomes an essential skill for every network and security engineer.

For environments using dedicated interfaces for internet access, ensure the service route for Palo Alto Services is configured correctly. Connect to the firewall's Command Line Interface (CLI)

Palo Alto Networks Next-Generation Firewalls (NGFWs) use a Trusted Platform Module (TPM) chip to securely store device certificates and cryptographic keys. This hardware-based security ensures device identity and enables secure cloud communications, such as retrieving licenses, downloading dynamic updates, and connecting to Cortex Data Lake.

On some PAN-OS versions (e.g., 12.1.x), temporary files ( .pub_pem ) may accumulate in /opt/pancfg/mgmt/ssl/private/ , filling the partition and blocking new certificate generation. Exit configuration mode and test the certificate fetch:

Failed to fetch device certificate: TPM public key match failed.

debug device-certificate clear request device-certificate fetch force Use code with caution. the error surfaces.

Elias realized then that no software command could fix this. You can't argue a machine back into sanity when its very sense of self is corrupted.

This issue is most frequently reported on hardware models like the PA-400 and PA-1400 series running PAN-OS 10.x or 11.x. Why Does This Error Happen?

On the Palo Alto firewall, the or Portal configuration under Network > GlobalProtect > Gateways may have the "Client Authentication" method set to "Require device certificate" but the Certificate Profile points to a CA that does not match the client’s TPM-backed certificate. Additionally, if "Use hardware certificate (TPM)" is enforced but the client’s TPM lacks a valid key, the error surfaces.

 

Hardware Installation & Configuration

Installation Steps
  

  • Check the parallel printer port setting in the bios, it should be EPP or Normal.
  • Check there are any active resident programs that use the printer port, such as TWAIN drivers. You may have to remove it.
  • Connect one end of the 25 pin SubD parallel cable  to PC printer port
  • Connect the other end  of parallel cable to 25 Pins port of the programmer
  • Connect USB power cable or AC adaptor (Note: if you are working on the EPROM programming. You may need use a AC adaptor, so that you can get Vcc 5.6V and 6.2V when doing programming)
  • The yellow power normal indicator of the programmer should light up, then the programmer power supply is normal.
  • Run the software
  • Select devices type
  • Click the Willem in toolbar to change to PCB3
  • Set the DIP switch based on the displayed pattern.

          (Note: the LPT port of PC MUST set to ECP or ECP+EPP during BIOS setup. To enter the BIOS setting mode, you need press "Del" key or "F1" key during the computer selftest, which is the moment of computer just power up.)

 

Software Version To Use

The software can be download from download.mcumall.com  

There are board hardware selection jumper on the board. When set the jumper to PCB3B, then user have to use 0.97ja and before version software.

If the board selection set to PCB3.5, PCB5.0, PCB5.5C, then the software 0.98D6 should be used.

 

          The software interface:

 

palo alto failed to fetch device certificate tpm public key match failed

 

Hardware Check

After start the program, click test hardwar under Help menu. If the connection and power supply is normal, then appears: "Hardware present"   Otherwise check if the programmer connects well with PC, or power supply is normal.

 

Jumper Configuration

 

PCB3.5/PCB4E

palo alto failed to fetch device certificate tpm public key match failed  
(Two PLCC32 adapter is not applied on the PCB4E)

PCB5.0

palo alto failed to fetch device certificate tpm public key match failed

PCB5.5C

palo alto failed to fetch device certificate tpm public key match failed

Note: the Vcc setting jumper only has effect when you are using AC adaptor as power source. For the USB power only 5V Vcc is available.

For the PCB5.5C, set DIP steps:

1. press DIP Set button twice to check current DIP bit position. Then set it again for ON or OFF.

2. press DIP Bit shift button to shift the DIP bit position to where need to set. And then press DIP Set button twice to check current DIP bit position. Then set it again for ON or OFF.

3. Repeat those steps till all DIP bit ae set  same as software indicated.

For PCB5.5C voltage and Special chip selection:

1. Put back the safety jumper.

2. Press the voltage button and hold for 1 second, the voltage LED should move to next. Repeat till desired voltage LED light up.

3. Press the chip selection button and hold for 1 second, the chip LED should move to next. Repeat till desired LED light up.

4. Remove the safety jumper to lock the selected voltage and chip selection

DIP Switch (PCB3.5, PCB5.0)

palo alto failed to fetch device certificate tpm public key match failed 

When programming one chip,  follow the program prompt to set DIP switch . 

 

 

Self Test Function 

Connect to the firewall's Command Line Interface (CLI) via SSH. Enter configuration mode: configure Use code with caution. Execute a forced commit: commit force Use code with caution. Exit configuration mode and test the certificate fetch: exit request certificate fetch Use code with caution.

By systematically following the steps outlined—verifying TPM health, deleting stale certificates, forcing fresh auto-enrollment, and resetting GP cache—administrators can restore seamless VPN connectivity without rebuilding machines or disabling TPM security. As enterprises move toward zero-trust architectures requiring hardware-backed identity, mastering TPM certificate troubleshooting becomes an essential skill for every network and security engineer.

For environments using dedicated interfaces for internet access, ensure the service route for Palo Alto Services is configured correctly.

Palo Alto Networks Next-Generation Firewalls (NGFWs) use a Trusted Platform Module (TPM) chip to securely store device certificates and cryptographic keys. This hardware-based security ensures device identity and enables secure cloud communications, such as retrieving licenses, downloading dynamic updates, and connecting to Cortex Data Lake.

On some PAN-OS versions (e.g., 12.1.x), temporary files ( .pub_pem ) may accumulate in /opt/pancfg/mgmt/ssl/private/ , filling the partition and blocking new certificate generation.

Failed to fetch device certificate: TPM public key match failed.

debug device-certificate clear request device-certificate fetch force Use code with caution.

Elias realized then that no software command could fix this. You can't argue a machine back into sanity when its very sense of self is corrupted.

This issue is most frequently reported on hardware models like the PA-400 and PA-1400 series running PAN-OS 10.x or 11.x. Why Does This Error Happen?

On the Palo Alto firewall, the or Portal configuration under Network > GlobalProtect > Gateways may have the "Client Authentication" method set to "Require device certificate" but the Certificate Profile points to a CA that does not match the client’s TPM-backed certificate. Additionally, if "Use hardware certificate (TPM)" is enforced but the client’s TPM lacks a valid key, the error surfaces.